Dev reviews

Signed-off-by: Michal Maléř <[email protected]>

Author: MichalMaler

_posts/2025-10-23-mmaler-blogpost-2-quarkus-runtime-and-framework-for-cloud-native-java.adoc

@@ -72,7 +72,7 @@ These features reflect Quarkus’s dual role: it behaves like a framework during
 
 === Performance that matters
 
-As described in the ACM article on application frameworks, Google's internal framework design emphasized fast startup and resilience against cascading failures.
+As described in the link:https://cacm.acm.org/practice/application-frameworks/[ACM article on application frameworks], Google's internal framework design emphasized fast startup and resilience against cascading failures.
 Quarkus was built with these principles in mind.
 
 Native image generation with GraalVM enables cold starts in milliseconds and a minimal memory footprint, allowing cost-effective deployment in containers and serverless environments.
@@ -82,16 +82,16 @@ Quarkus also includes structured health checks, metrics, and tracing, thereby al
 image::7-success-stories.png[alt="Real-world success stories using Quarkus", width=100%]
 
 
-=== Secure by default
+=== Security
 
-Quarkus separates application logic from infrastructure concerns.
-By structuring the request lifecycle with standardized handlers such as exception mappers, filters, and interceptors, it supports strong security practices:
+Quarkus uses a standards-first, composable, opt-in security model.
+You enable what you need and configure it for your environment:
 
-* Secure headers and CSRF protection out of the box.
-* Native support for role-based access control.
-* Seamless integration with OpenID Connect providers.
+* **Transport:** enable TLS for HTTPS, or terminate TLS at your ingress.
+* **Authentication:** choose Basic, form-based, mTLS, or OpenID Connect (OIDC).
+* **Authorization:** enforce RBAC on web endpoints with `@RolesAllowed`, `@DenyAll`, and `@PermitAll`.
 
-Just as Google’s frameworks reduced vulnerabilities through safe APIs and typed response models, Quarkus applies similar principles by using conventions and standardized components to promote secure defaults and trusted integrations.
+This keeps defaults minimal and lets you apply the right controls for each deployment.
 
 === Observability and control surfaces
 
@@ -101,7 +101,7 @@ Quarkus exposes:
 
 * Unified logging via quarkus-logging.
 * Structured metrics and tracing with Micrometer and OpenTelemetry.
-* Declarative configuration via application.properties or environment overrides.
+* Unified configuration of all the application's aspects via `application.properties` or environment variables.
 
 This standardization enables automation and scalable monitoring.